“The door is heavy to remind you of the importance of what you’re trying to protect. That’s what I’ve taken for my whole career.” 

Who They Brought In 

James Gorman is the Fractional CISO and CTO at Hard2Hack, and the author of two books: “Security in the Age of AI Agents: A Practitioner’s Journey from Cold War Crypto to Autonomous Threats” and “The IT Leader’s Guide to Cybersecurity Programs: From Basics to AI.” His path into cybersecurity started 40 years ago when he reported aboard a Navy ship as a freshly minted cryptographic technician, responsible for the fleet-wide encryption keys that secured communications across an entire naval operation. From there he learned TCP/IP in 1988 when the Navy deployed an encrypted satellite network running at 115kbps, got out in 1992 when DARPA net was becoming the internet, was recruited by GE to help open their systems to this new thing, started one of the first ISPs in 1994, and has spent the decades since doing fractional CISO work across SaaS startups, healthcare organizations, government contractors, and mid-market manufacturers. He has helped approximately 30 companies build or rebuild their security programs, and he brings the kind of practitioner perspective that most compliance documentation specifically does not. 

What Got Loud 

• The heavy door story: the reason a crypto locker door is that heavy is not just security. It is a physical reminder of the weight of what you are protecting. James has carried that framework for 40 years 
• CMMC being delayed does not change your legal obligation. You are still required to self-attest, still required to meet NIST 800-171, and still exposed to contract penalties if you get breached and it was your fault 
• McKinsey built an internal AI trained on all 57,000 employees’ work history and left 18 API endpoints with no authentication. A researcher got in through SQL injection in under three hours and could have exported everything 
• A $500 million ISO 27001-certified manufacturer opened their entire Active Directory to fix a VPN issue, forgot to close it, and got ransomware dropped through a print service account using an easy-to-guess password. While ISO 27001 certified. 
• Why presenting cybersecurity as a math problem is the only way to get a CEO or CFO to actually engage with it. 96% of small and mid-sized businesses that suffer a severe cyberattack are out of business within four years 

The Rundown 

James’s entry framework has not changed since a chief petty officer named Chief Smith asked him why he thought that door was so heavy. The answer is not that the door is heavy because the stuff inside is important. The answer is that the door is heavy to make you feel the importance every time you touch it. James has applied that to every engagement since. What are you trying to protect? Sales records are one level of heaviness. Healthcare data is another. Government contractor CUI is heavier still. Water treatment terminals, where lives are at stake, are something else entirely. The framework for everything that follows, the architecture, the controls, the budget conversation, starts with that question. And most organizations have never seriously answered it. 

The compliance versus security conversation is where James is most direct. His position is that a compliance checkbox has never once made a company secure. He walked into a company processing billions of dollars a year in transactions and found their disaster recovery policy sitting on a shelf in the server room. Nobody knew it existed. He watched another company click through security awareness training modules and call it done for the year. He has seen SOC 2 audit firms issuing boilerplate reports where no controls were tested. His line is consistent throughout the episode: by being genuinely secure, compliance follows on its own. The reverse has never worked. 

The McKinsey story is the AI security argument in one incident. McKinsey built an internal LLM trained on the entire work history of their organization, including client deliverables, strategy documents, and consulting processes for 57,000 employees. A researcher built an AI tool to probe it from the outside. He got in through a single API endpoint with no authentication requirement using SQL injection, a technique documented for decades. Once inside he could have exfiltrated hundreds of thousands of documents and, more critically, could have manipulated the prompts that drive McKinsey’s consulting recommendations. A tweaked prompt on a buy-sell decision could redirect billions in client capital. McKinsey’s CISO responded correctly. But the point James makes is the quiet one underneath: he may not have been the first person in. 

The manufacturer story runs a parallel track. ISO 27001 certified, policies documented, controls in place on paper. IT opens Active Directory to the full VPN during a troubleshooting session and never closes it. Service accounts pick up the exposure. Ransomware comes through a print service account using a password that was basically the company name with a number and an exclamation point. Shipping shuts down. $15 million in losses in two days. Cyber insurance covers $5 million. The other $10 million is on the company. And six months after James is brought in for incident response, the same executives who were writing any check necessary start asking whether they can cut the security budget. 

Real Talk 

If you cannot answer the question of what you are actually protecting and why it matters, you do not have a security program. You have a policy document and a hope. Start with the door. 

If your Microsoft 365 environment hasn’t been reviewed lately, let’s fix that before someone else does it for you. Visit www.SOCSoter.com